· 9 years ago · Sep 05, 2016, 10:44 PM
1# vim:syntax=apparmor
2# Author: Simon Deziel <simon.deziel at gmail_com>
3# This apparmor profile is provided as-is
4
5# Declare an apparmor variable to help with overrides
6@{MOZ_LIBDIR}=/usr/lib/thunderbird
7
8#include <tunables/global>
9# We want to confine the binaries that match:
10# /usr/lib/thunderbird/thunderbird
11# /usr/lib/thunderbird/thunderbird
12# but not:
13# /usr/lib/thunderbird/thunderbird.sh
14/usr/lib/thunderbird/thunderbird{,*[^s][^h]} {
15 #include <abstractions/audio>
16 #include <abstractions/aspell>
17 #include <abstractions/base>
18 #include <abstractions/cups-client>
19 #include <abstractions/dbus-session>
20 #include <abstractions/fonts>
21 #include <abstractions/freedesktop.org>
22 #include <abstractions/gnome>
23 #include <abstractions/ibus>
24 #include <abstractions/nameservice>
25 #include <abstractions/p11-kit>
26 #include <abstractions/ssl_certs>
27 #include <abstractions/user-tmp>
28 #include <abstractions/user-download>
29 #include <abstractions/ubuntu-browsers>
30 #include <abstractions/ubuntu-helpers>
31
32 # for networking
33 network inet stream,
34 network inet6 stream,
35 @{PROC}/[0-9]*/net/if_inet6 r,
36 @{PROC}/[0-9]*/net/ipv6_route r,
37 @{PROC}/[0-9]*/net/dev r,
38 @{PROC}/[0-9]*/net/wireless r,
39
40 # should maybe be in abstractions
41 /etc/ r,
42 /etc/mime.types r,
43 /etc/mailcap r,
44 /etc/xdg/*buntu/applications/defaults.list r, # for all derivatives
45 /usr/share/xubuntu/applications/defaults.list r,
46 owner @{HOME}/.local/share/applications/defaults.list r,
47 owner @{HOME}/.local/share/applications/mimeapps.list r,
48 owner @{HOME}/.local/share/applications/mimeinfo.cache r,
49 owner /tmp/** m,
50 owner /var/tmp/** m,
51 /tmp/.X[0-9]*-lock r,
52
53 /etc/timezone r,
54 /etc/wildmidi/wildmidi.cfg r,
55
56 # thunderbird specific
57 /etc/thunderbird/ r,
58 /etc/thunderbird/** r,
59 /etc/xul-ext/** r,
60 /etc/xulrunner-2.0*/ r,
61 /etc/xulrunner-2.0*/** r,
62 /etc/gre.d/ r,
63 /etc/gre.d/* r,
64
65 # noisy
66 deny @{MOZ_LIBDIR}/** w,
67 deny /usr/lib/thunderbird-addons/** w,
68 deny /.suspended r,
69 deny /boot/initrd.img* r,
70 deny /boot/vmlinuz* r,
71 deny /var/cache/fontconfig/ w,
72 deny @{HOME}/.local/share/recently-used.xbel r,
73 deny @{HOME}/.* r,
74
75 # These are needed when a new user starts thunderbird and thunderbird.sh is used
76 @{MOZ_LIBDIR}/** ixr,
77 /usr/bin/basename ixr,
78 /usr/bin/dirname ixr,
79 /usr/bin/pwd ixr,
80 /sbin/killall5 ixr,
81 /bin/which ixr,
82 /usr/bin/tr ixr,
83 @{PROC}/ r,
84 @{PROC}/[0-9]*/cmdline r,
85 @{PROC}/[0-9]*/mountinfo r,
86 @{PROC}/[0-9]*/stat r,
87 owner @{PROC}/[0-9]*/task/[0-9]*/stat r,
88 @{PROC}/[0-9]*/status r,
89 @{PROC}/filesystems r,
90 owner @{HOME}/.thumbnails/*/*.png r,
91
92 /etc/mtab r,
93 /etc/fstab r,
94
95 # Needed for the crash reporter
96 owner @{PROC}/[0-9]*/environ r,
97 owner @{PROC}/[0-9]*/auxv r,
98 /etc/lsb-release r,
99 /usr/bin/expr ix,
100 /sys/devices/system/cpu/ r,
101 /sys/devices/system/cpu/** r,
102
103 # about:memory
104 owner @{PROC}/[0-9]*/statm r,
105 owner @{PROC}/[0-9]*/smaps r,
106
107 # Needed for container to work in xul builds
108 /usr/lib/xulrunner-*/plugin-container ixr,
109
110 # allow access to documentation and other files the user may want to look
111 # at in /usr and /opt
112 /usr/ r,
113 /usr/** r,
114 /opt/ r,
115 /opt/** r,
116
117 # so browsing directories works
118 / r,
119 /**/ r,
120
121 # per-user thunderbird configuration
122 owner @{HOME}/.thunderbird/ rw,
123 owner @{HOME}/.thunderbird/** rw,
124 owner @{HOME}/.thunderbird/**/storage.sdb k,
125 owner @{HOME}/.thunderbird/**/*.{db,parentlock,sqlite}* k,
126 owner @{HOME}/.thunderbird/plugins/** rm,
127 owner @{HOME}/.thunderbird/**/plugins/** rm,
128 owner @{HOME}/.config/ibus/bus/ w,
129 owner @{HOME}/.{cache,config}/dconf/user rw,
130 owner @{HOME}/.cache/thunderbird/ rw,
131 owner @{HOME}/.cache/thunderbird/** rw,
132
133 # Extensions
134 # /usr/share/.../extensions/... is already covered by '/usr/** r', above.
135 # Allow 'x' for downloaded extensions, but inherit policy for safety
136 owner @{HOME}/.thunderbird/**/extensions/** mixrw,
137 owner @{HOME}/.mozilla/extensions/** mixr,
138 /usr/share/xul-ext/**/*.sqlite rk,
139 /usr/lib/xul-ext/**/*.sqlite rk,
140 /usr/lib/thunderbird-addons/extensions/**/*.sqlite rk,
141
142 deny @{MOZ_LIBDIR}/update.test w,
143 deny /usr/lib/mozilla/extensions/**/ w,
144 deny /usr/lib/xulrunner-addons/extensions/**/ w,
145 deny /usr/share/mozilla/extensions/**/ w,
146 deny /usr/share/mozilla/ w,
147
148 # Miscellaneous (to be abstracted)
149 # Ideally these would use a child profile. They are all ELF executables
150 # so running with 'Ux', while not ideal, is ok because we will at least
151 # benefit from glibc's secure execute.
152 /usr/bin/mkfifo Uxr, # investigate
153 /bin/ps Uxr,
154 /bin/uname Uxr,
155
156 /usr/bin/gpg Cx -> gpg,
157
158 profile gpg {
159 #include <abstractions/base>
160
161 # Required to import keys from keyservers
162 #include <abstractions/nameservice>
163 #include <abstractions/p11-kit>
164
165 # LDAP key servers
166 /etc/ldap/ldap.conf r,
167
168 /usr/bin/gpg mr,
169 /usr/lib/gnupg/gpgkeys_* ix,
170 owner @{HOME}/.gnupg r,
171 owner @{HOME}/.gnupg/gpg.conf r,
172 owner @{HOME}/.gnupg/random_seed rwk,
173 owner @{HOME}/.gnupg/pubring.gpg{,~} rw,
174 owner @{HOME}/.gnupg/secring.gpg rw,
175 owner @{HOME}/.gnupg/trustdb.gpg rw,
176 owner @{HOME}/.gnupg/*.gpg.{lock,tmp} rwl,
177 owner @{HOME}/.gnupg/.#*[0-9] rw,
178
179 owner @{HOME}/** r,
180 owner /tmp/** r,
181 owner /tmp/encfile* wr,
182 }
183
184 # Site-specific additions and overrides. See local/README for details.
185 #include <local/usr.bin.thunderbird>
186}